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This paper presents an interface system display which is conceived to improve pilot 
situation awareness with respect to a flight envelope protection system developed for a 
mid-sized transport aircraft. The new display is designed to complement existing cockpit 
displays, and to augment them with information that relates to both aircraft state and the 
control automation itself. In particular, the proposed display provides cues about the state 
of automation directly in terms of pilot control actions, in addition to flight parameters. 
The paper also describes a forthcoming evaluation test plan that is intended to validate 
the developed interface by assessing the relevance of the displayed information, as well as 
the adequacy of the display layout. 


I. Introduction 

Automated systems are common in the cockpits of transport class aircraft, and the level of complexity 
of cockpit automation has steadily increased. There are now many more levels of technology between the 
pilot and the aircraft control surfaces than were present only a few decades ago. Automated systems have 
the benefits of improving aircraft handling qualities and reducing pilot workload under normal operating 
conditions, among other benefits. At the same time, cockpit automation has increased the likelihood of 
human error, and human factors problems arising from prolific use of automated systems are highly active 
areas of research. One of the main problems that occurs when tasks are automated is that the true state of 
the aircraft may be disguised or altogether obscured in the event of a failure or in a vehicle upset condition. 
Moreover, today’s automation is predominantly designed for nominal conditions and often disengages when 
conditions become off-nominal which can add further confusion to the crew at the worst possible time and/or 
result in transient disturbances that further exacerbate the adverse condition. Approaches to reducing the 
opacity of the automation with respect to the flight crew include pilot training, system design tools, and 
feedback displays [1]. 

In this paper, we adopt the latter approach; we design a display that incorporates tools and devices that 
are already familiar to the pilot to provide information about the vehicle dynamical state, and augment it 
with additional information about the state of onboard automation. In particular, we present here the design 
of a novel pilot interface designed around a dynamic Flight Envelope Protection (FEP) system augmented 
with logic for loss-of-control (LoC) prediction and prevention implemented on NASA’s Transport Class 
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Model (TCM) [2,3]. Incorporation of envelope protection into the flight control system, while desirable to 
prevent the aircraft from entering unsafe conditions, necessitates improved pilot feedback methods. In the 
event that the FEP system intervenes, the pilot is forced to infer its action through the aircraft performance 
indicators or through some other alert. The objective of the display design is therefore to reduce the opacity 
of the automated FEP system by presenting dynamic flight envelope limit information in reference to both 
the aircraft performance indicators and the pilot control input space, as well as displaying the state and 
output of the protection system. 

The remainder of this paper is organized as follows: Section II presents the motivation for the design 
and integration of the display, and Section III provides background information related to the flight control 
system and FEP system. Sections IV and V discuss the design and operation of the proposed cockpit display, 
and Section VI provides discussion of a forthcoming piloted simulation test plan for display evaluation. 
Section VII offers some concluding remarks. 

II. Motivation 

Two factors have promoted a significant increase over recent decades in the level of research devoted to 
achieving safe and effective human-automation interaction. As described in [4], the 1980s saw the imple- 
mentation of significantly higher levels of automation functionality in aviation, such as flight management 
computers, known colloquially as a transition to the “glass cockpit.” This transition resulted in the identi- 
fication of numerous problems in coupling flight crews with automated systems [5], and it took about two 
decades of research, redesign, and new training methods before pilot confidence in automation and pilot 
proficiency in using automation effectively became widespread. 

Yet, problems associated with achieving a safe and efficient integration of pilots and flight control au- 
tomation continue to exist, most typically as a result of the inability of flight crews to understand the true 
state of the aircraft and the state of the onboard automated systems. These problems have resulted in a 
number of high-profile commercial aviation accidents. For example, the crash of Air France flight 447 was the 
result of the failure of the automation to clearly disclose sensor inconsistencies as detected by the automation 
until the disconnection of the autopilot [6]. In another incident, American Eagle flight 4184 crashed near 
Roselawn, IN after automation returned control to pilots with no indication of current envelope limitations 
for safe control input or recovery under icing conditions [7]. Additionally, automation actions not desired 
nor understood by the pilots resulted in the crash of Scandinavian Airlines flight 751 [8]. Much more re- 
cently, misunderstanding of the autothrottle operation during approach led to the collision of Asiana Airlines 
flight 214 with the runway seawall in San Francisco [9]. In each of these incidents, the state of the automated 
systems was opaque to the flight crew, and in some cases the actions of the automation obscured the state 
of the aircraft as well. As the level of automation in the cockpit increases, it becomes ever more important 
to improve the pilot interface to provide the flight crew with an intuitive and veridical representation of not 
only the state of the aircraft, but also the state of the onboard automated systems. 

Recently, advanced control automation has been broadly implemented for commercial and research ap- 
plications, prompting novel concepts for more flexibly and robustly designing human-automation interac- 
tion, most notably, techniques for adaptive automation, adaptable automation, adjustable autonomy, and 
mixed-initiative control schemes [10-12]. For example, the adaptive automation approach attempts to make 
automation more intelligent so it provides humans increased support when it is most needed, as in conditions 
of high workload. Alternatively, the adaptable automation approach gives humans discretionary control over 
the level of automation active at any time. Adjustable autonomy and mixed initiative schemes are even 
more sophisticated, seeking to emulate a flexible, shared or distributed control allocation scheme between 
humans and automation akin to how teams of people self-organize and reconfigure their responsibilities in 
the face of changing circumstances and task demands. 

At this point no single magic bullet yet exists for designing the safest and most effective human- 
automation interaction protocol in the general case. Universal agreement, however, does exist on at least a 
few tenets for supporting robust and effective human-automation interaction. First, and motivated in part 
by aforementioned examples of incidents and accidents due to automation failure, agreement exists that the 
ultimate authority for mode of control (human vs. automation) will rest with the human operator [13]. Due 
to the inability of engineers to anticipate all possible situations, events, failures, etc., it is only realistic to 
put ultimate control authority in the hands of the human, who may at least have the opportunity to im- 
provise [14] a control solution for unanticipated situations, or situations thought to be virtually impossible 
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(e.g., in aviation, a double bird-strike failing two engines simultaneously, as with US Airways flight 1549, or 
an engine failure knocking out all three of an aircraft’s hydraulic systems, as in United Airlines flight 232). 

A second uncontroversial tenet is that automation that draws the operator out of control loops does so 
at the cost of the human’s situation awareness [15,16], resulting in a problem known as “out-of-the-loop” 
syndrome. As described in [17], the problem is not so much “over-automation” but instead the fact that all 
too often automation is designed without providing the operator with sufficient feedback on its current and 
future behavior. As such, there is tremendous motivation for novel cockpit interface design solutions that will 
allow the pilot, while remaining in the control loop, to be maximally informed about the underlying, often 
opaque, state of control automation. Specifically, the adoption of interface designs that provide adequate 
feedback to maximize pilot situation awareness with respect to aircraft automation has the opportunity to 
improve aviation safety by directly addressing human-automation interaction issues. In the rest of this paper 
we present an attempt to apply the aforementioned design tenets to an augmented aircraft model with an 
automated FEP system. 


III. Background 

III. A. iReCoVeR Control Architecture 

The Integrated Reconfigurable Controller for Vehicle Resilience (iReCoVeR) is part of an ongoing research 
collaboration between researchers at the University of Illinois at Urbana-Champaign (UIUC) and the Uni- 
versity of Connecticut (UConn), in an effort to develop technologies to prevent accidents and incidents 
resulting from LoC events in transport class aircraft. The iReCoVeR architecture is based on the AIRSAFE 
concept [18-20], and integrates technologies for fault-tolerant flight control [21,22], fault detection and iso- 
lation [23], safe flight envelope estimation and protection [2], and LoC prediction and prevention [3]. Under 
this concept, the core subsystems of the iReCoVeR architecture work together to arrest the development 
of an LoC sequence by breaking the chain of events at its different stages. In addition, to ensure a robust 
interaction between pilots and the iReCoVeR automation, the framework also envisions the design and in- 
tegration of enhanced cockpit interfaces. These interfaces should be conceived to make the behavior of the 
iReCoVeR automation transparent to the flight crew by providing timely and effective situation awareness, 
not solely about the aircraft, but also about the current and future operation of the developed automa- 
tion. The iReCoVeR architecture along with the situational awareness interfaces are shown schematically in 
Figure 1. 


Pilot/ Guidance Loops LOC Prevention Aircraft 



Figure 1: The iReCoVeR flight control architecture for loss-of-control prevention. 
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III.B. Flight Envelope Protection System 


In [2], the authors present the design and implementation of a dynamic FEP system, which is one of the 
core subsystems of the iReCoVeR architecture. The FEP system ensures that the aircraft remains within 
a predefined (dynamic) portion of the flight envelope that is determined to be safe. The protection scheme 
is based on a command-limiting architecture that is designed to protect excursions in angle of attack, angle 
of sideslip, pitch angle, bank angle, vertical load factor, airspeed (or dynamic pressure), and total specific 
energy. The protection scheme related to flight parameters of the longitudinal dynamics of the aircraft has 
a hierarchical structure based on the criticality of each flight parameter, and relies on dynamic inversion 
control laws to anticipate limit exceedances and, when required, generate command signals that prevent 
the protected flight parameters from exceeding their corresponding limits. The lateral- directional protection 
scheme instead has a parallel architecture that relies on simple control laws designed to prevent excursions in 
bank angle and angle of sideslip. Moreover, a pitch-to-bank cross-feed prevents overspeed limit exceedances 
in tight turns. The system also includes a total energy protection scheme that adjusts engine power setting 
and speedbrake deflection to prevent the aircraft from flying into inadmissible energy states. Figure 2 shows 
a functional block diagram of the dynamic flight envelope protection system proposed in [2] . 


Flight Envelope Protection Flight Control Law 



Figure 2: Functional block diagram of the command-limiting flight envelope protection scheme. 


The protection system is augmented with an LoC-prediction logic that actively controls the limits of the 
protected envelopes; see [3]. These dynamic limits, which characterize the safe flight envelope at a given 
time, are constrained to vary between appropriately defined absolute limits (which are to be understood 
as “never-exceed limits”) and more restrictive LoC limits , depending on aircraft configuration and flight 
condition^ Figure 3 shows the set of limits used in [3] for the FEP system developed for NASA’s TCM. The 
limits appear grouped in three two-dimensional envelopes relating to aircraft aerodynamics, flight dynamics, 

a The design of the LoC-prediction logic described in [3] is based on the quantitative definition of loss of control proposed 
in [24], 
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Figure 3: Absolute and loss-of-control limits used in [3] for the flight envelope protection system developed 
for NASA’s TCM. ( Solid blue: loss-of-control limits; solid red: absolute limits.) 


and structural integrity. We note that throughout this paper we will refer to the dynamic limits used by the 
protection scheme as hard limits, while the more restrictive LoC limits will be referred to as soft limits. 

Because the FEP system can override the commands generated by the pilot, it is critical to augment this 
automation with cockpit interfaces that provide appropriate feedback to the flight crew, so as to mitigate 
potential negative interactions between the pilot, the protection system, and the aircraft. In the next section, 
we propose a novel interface display that is intended to make the behavior of this protection system maximally 
transparent to the pilot. The design of the new display builds upon a standard general-aviation primary 
flight display, which is then augmented with both quantitative and qualitative information provided by the 
FEP system. The newly added information relates to both aircraft state and pilot control inputs, and thus 
the proposed display provides cues about the state of automation directly in terms of pilot control actions, 
in addition to flight parameters. Moreover, as will become clear later in the paper, the automation-interface 
system can be operated such that the protection system does not override pilot commands, but it is only 
used to provide “suggested” commands to the flight crew through the developed interface. 

IV. Display Design 

The instrument panel used for this project is designed to represent the critical flight parameter ranges 
for a medium sized transport category aircraft, based on NASA’s TCM dynamical model. The layout 
of the instrument panel display elements closely follows the primary flight display (PFD) used to fly the 
NASA AirSTAR vehicle [25]. Although the AirSTAR PFD was presented as a modified heads-up display, 
the adaptation presented in this paper necessitates a heads-down configuration that precludes any out- 
the-window information from being presented. Furthermore, this modified arrangement is in line with the 
blended primary flight display discussed in [26], and is a format that has been adopted in Boeing transport 
category aircraft. 

The PFD, shown in Figure 4, consists of the flight instrumentation superimposed on a black background. 
Display elements are in lighter contrasting colors that can be easily differentiated and comply with FAA and 
industry recommendations for electronic display color coding [27]. Display instrumentation can be differen- 
tiated via (i) a break in background coloring, (ii) display element coloring and/or shape, and (Hi) placement 
relative to the central flight instrument. The addition of three new displays to the instrument panel facil- 
itate the transfer of new flight parameter information to the pilot. However, the placement of two of the 
new displays directly next to the attitude indicator, while designed to support pilot awareness of energy 
information, is in conflict with the regulatory requirement of FAA §25. 1321(b) for electronic display of flight 
instrumentation. However, since these displays are being investigated for their utility in maintaining en- 
ergy state awareness, it is necessary to place them in locations that are most congruent with the pilot’s 
expectations. 
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Figure 4: Primary flight display with FEP limit augmentation. 


IV. A. Primary Flight Display 

IV. A. 1. Airspeed Tape 

The airspeed indication is located to the left side of the instrument panel to form the T-line concept (also 
referred to as the Basic-T); the “T” being formed by the command indicators of the airspeed, altitude and 
neutral pitch bar aligned horizontally to each other [26,27]. The indicator is of the vertical tape style with 
white numerals superimposed on a dark grey background. Major airspeed values indicated by tick marks at 
every 20 knots calibrated airspeed (KCAS), and unlabeled tick marks at every 10 KCAS. Current airspeed 
is indicated in a white bordered box marker and is centered vertically in the tape scale. 

Additional symbology has been added to the airspeed indicator to provide the pilot with FEP-derived 
airspeed limit information. A pair of yellow bars are added to the airspeed tape to provide the pilot with 
an indication of the FEP upper airspeed limit. The soft limit is coded by a yellow bar that crosses the 
normal airspeed tick marks and extends to a large yellow tick mark that indicates the (dynamic) hard limit, 
nominally 350 KCAS. The lower limit for airspeed is indicated by a red and white tape superimposed on the 
airspeed tape, to maintain consistency with current practice for indication of critically low airspeed. 

IV. A. 2. Angle of Attack Scale 

Inset between the airspeed tape and the attitude indicator, the angle of attack (AoA or a) indicator is a 
new display feature and represents the range of AoA values possible for this transport category model. Its 
location next to the airspeed tape facilitates a quick comparison during critical flight phases such as slow 
speed operations. As opposed to a current indication box marker, the AoA tape display utilizes a running 
bar scale with a chevron-shaped marker to indicate the current AoA value. Slightly less salient size and 
color differentiates this tape scale from the nearby airspeed tape. Major AoA increments are indicated by 
labeled tick marks at every 10 degrees with unlabeled tick marks every 5 degrees in-between. The full range 
is always displayed on the tape and is representative of simulation data [2] . 

FEP-derived limit symbols have also been added to the AoA scale. Upper and lower hard and soft limits 
are displayed to indicate the boundaries of the safe range of AoA. Soft limits are indicated by a yellow bar 
crossing the normal AoA tick marks and hard limits are indicated by yellow bars parallel to the normal tick 
marks. The range of safe AoA values between the positive and negative hard limits depends on the location 
of the aircraft with respect to the three envelopes in Figure 3, as described in Section III.B. Additional 
description of how the FEP limits are modified can be found in [3] . 
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IV. A. 3. Attitude Indicator 

Sizing of the attitude indicator display was modeled directly from a Rockwell Collins EFIS-700 electronic 
flight system attitude-direction-indicator unit. Display elements presented in the attitude indicator include 
a conventional pitch ( 9 ) ladder with major labeled increments at every 10 degrees and minor increments 
every 2.5 degrees. Red chevrons are visible in the ladder at ±50 degrees and serve to advise the pilot as to 
the direction of neutral pitch during extreme attitude maneuvering. At the top of the attitude display is an 
angle of bank (cj>) arc with major tick marks at 30 and 60 degrees and minor tick marks at every 10 degrees. 
By design, the angle of bank indicator does not serve as a sky pointer, but retains its aspect to the pitch 
indicator ladder during banked flight. In keeping with the standard coloring, the background area above 
zero degrees pitch is blue and below zero degrees is brown [27]. Current pitch is indicated by a black pitch 
dot with miniature wings. 

Four sets of soft and hard limit bars are added to the attitude indicator representing the FEP limits. 
For pitch limits, a vertical yellow bar crossing the pitch ladder indicates the soft limit and a horizontal bar 
parallel to the pitch ladder tick marks indicates the hard limit for both positive and negative pitch values. 
Bank angle soft limits are indicated by a yellow arc that crosses the angle of bank tick marks, while hard 
limits are indicated by a yellow bar parallel to the tick marks. Both pitch and bank angle limits are a 
function of aircraft location with respect to the three envelopes of Figure 3, as described in Section III.B 
and in further detail in [3]. 

IV. A. 4- Altimeter Tape 

The altimeter indicator is of standard tape design and is located to the right of the attitude indicator. Major 
tick marks are labeled every 200 ft with minor unlabeled tick marks at 100 ft. Coloring is the same as for 
the airspeed indicator. Current altitude is indicated in a command marker box similar in appearance to that 
used for airspeed. 

IV. A. 5. Vertical Speed Indicator 

The vertical speed indicator is of standard design and located to the right of the altimeter indicator tape. 
Coloring is the same as for the airspeed indicator. The display has major tick marks appropriate to the range 
of the aircraft’s performance. Major tick marks are labeled at 1000, 2000, and 6000 feet-per-minute and 
minor tick marks at 500 ft/rnin between zero and 2000, and 2000 ft/min between 2000 and 6000. Current 
vertical speed is indicated by a white running bar that extends from zero. The zero point is level with neutral 
pitch, as well as the command box indicators for the airspeed and altimeter tapes. 

IV. A. 6. Load Factor Scale 

Between the attitude indicator and the altimeter tape is a new display to indicate load factor in the z-axis. 
Similar to the AoA scale, the load factor ( n z ) display utilizes a running bar scale with a chevron-shaped 
marker to indicate the current n z value. Slightly less salient size and color differentiates this scale from the 
nearby altitude tape. The scale ranges from -lg to 4g with major load factor increments indicated by labeled 
tick marks at every lg and unlabeled tick marks every 0.5g. The full range is always displayed on the tape 
and is representative of simulation data [2] . 

As with other protected flight parameters, upper and lower FEP limits are superimposed onto the load 
factor scale to provide the pilot with an indication of the aircraft’s proximity to the envelope limits. Soft 
limits are indicated by a yellow bar crossing the normal load factor tick marks and the hard limits are 
indicated by a yellow bar parallel to the normal tick marks. The range of safe load factor values between 
the positive and negative hard limits depends on the location of the aircraft with respect to the envelopes 
of Figure 3, as described in Section III.B and [3]. 

IV. A. 7. Angle of Sideslip Scale 

The sideslip scale is a new display feature and represents the range of expected possible sideslip angles (/3) 
that can occur during flight for this aircraft model. The scale is located directly below the attitude indicator 
and uses the same layout and coloring as the angle of attack and load factor scales. The scale is zero-centered 
and ranges from -15 to 15 degrees with tick marks and labels every 5 degrees. Here positive values indicate 
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right sideslip. The inclusion of this new display renders the standard split trapezoid sideslip indicator at the 
top of the attitude indicator redundant; therefore the split trapezoidal indicator is not displayed. 

The FEP limits for this display element are indicated by yellow bars as a function of aircraft location 
with respect to the envelopes of Figure 3. Similar to the other limit indicators, soft limits are indicated by 
a yellow bar crossing the normal sideslip tick marks and hard limits are indicated by yellow bars parallel to 
the normal tick marks. 

IV. A. 8. Heading Indicator 

The heading indicator arc is located below the sideslip scale and completes the T-line arrangement of critical 
flight instrumentation. Presented as a partial arc, 110 degrees of heading ('*/>) are visible with a current 
heading command marker box at the top of the scale. A lubber line extends below the scale as in conventional 
horizontal situation indicators. Coloring of the scale is the same as the airspeed indicator. Tick marks 
indicate every 5 degrees of heading, with major tick marks every 10 degrees and labels every 30 degrees. 

IV. B. Envelope Protection Display 

The FEP system described in [2] and [3] limits pilot control inputs to prevent violations of critical flight 
parameter limits. Pilot control inputs and safe flight envelope limits are monitored by the FEP system, which 
modifies the control inputs as necessary to keep the aircraft within this set of safe operational envelopes. 

To the right of the PFD, the Envelope Protection Display (EPD) - shown in Figure 5 - is a new display 
that indicates the pilot control inputs and the modifications to these inputs by the FEP system. The display 
represents an indication of the available control authority 13 , accounting for both pilot intent (yoke, wheel, 
pedal, and throttle control inputs) and aircraft safety (safe envelope violations). The display in a way also 
represents a mapping of the FEP limits into the aircraft control input space, indicating the pilot commands 
required to maintain safe operation of the aircraft. All of the elements of the EPD, which are described in 
detail in the remainder of this section, are driven by the FEP system logic. In this sense, the development of 
this display does not require the implementation of any significant additional logic in the control architecture 
presented in [2,3]. 



Figure 5: Envelope Protection Display. 


b Here, we refer to control authority as the margin between the current pilot command input and the FEP input space 
limits, not necessarily the available control surface deflection with respect to actuator limits. 
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IV.B.l. Pilot Input Display 

The Pilot Input Display (PID) consists of a square pitch/roll command box positioned directly to the right 
of the PFD, approximately the same size as the attitude indicator, and a horizontal yaw command bar below 
the box. Horizontal and vertical axes bisect the box, with the intersection of the axes level with the neutral 
pitch indicator. The vertical axis is an indication of pitch-axis control input, and follows a “nose-pointing” 
convention for positive and negative pitch commands. Thus a more positive control input (higher vertical 
position within the box) will pitch the aircraft nose up. The horizontal axis indicates roll-axis control inputs. 
Both axes are normalized from -1 to 1 such that the edges of the box represent the maximum possible values 
for the inputs. Axis tick marks are set to 0.2, representing 10% of the total input range. The yaw bar is 
positioned directly below the box and indicates yaw channel input commands. The upper and lower limits 
of the yaw bar are normalized in the same manner as the pitch and roll axes, with tick marks every 0.2. The 
edges of the pitch/roll box and the yaw bar are white to ensure visibility against a black background. 

Within the pitch/roll box is a light gray box with dynamic borders defined by yellow bars. The interior 
of the light gray box defines the set of “safe” control inputs c . Restriction of control inputs to within the light 
gray box will ensure that the aircraft never exceeds the hard FEP limits and does not enter into a potentially 
unsafe state as defined by the envelopes of Figure 3. The area of safe control inputs is dynamic and changes 
as a function of aircraft state and pilot inputs. In certain conditions, the safe area may shrink down to a 
point; in this case the point represents the only safe input (or the safest input). Any unsafe portion of the 
pitch/roll box (defined as being outside the yellow-bordered safe area) is shaded in dark gray. The safe area 
of the yaw bar is defined by a light gray interval with yellow edge markers, with unsafe areas shaded dark 
gray. Functionality of the yaw bar is the same as that of the pitch/roll box. 

The PID also shows control inputs, which are indicated by round markers on the pitch/roll box and 
vertical bars on the yaw bar. A blue marker indicates the control input set by the pilot. In addition, a green 
marker indicates the actual control input that is being sent to the aircraft as computed by the FEP, i.e. , the 
most preferable control input, taking into account both pilot intent and aircraft safety. Whenever the pilot 
sets a safe control input, the command of the FEP is identical to the pilot command, and the input is shown 
as a blue marker with a green halo. 

IV.B.2. EPR Scale with FEP Display 

The engine pressure ration (EPR) scale provides the pilot with an indication of power produced by each 
engine, and is controlled via the throttle lever for both engines. For each engine, a white chevron-shaped 
command marker indicates the commanded EPR level corresponding to the current setting of the throttle 
lever. Two blue bars extending upwards from the bottom of the tape indicate the actual EPR of the engines. 
A digital readout of EPR is shown just below the tape for each respective engine. The color convention for 
the EPR scale is slightly different than that for the PID. The engine dynamics are slow compared to the 
aircraft pitch, roll, and yaw dynamics, where the aircraft response is roughly equivalent to the commanded 
input. It is therefore necessary to indicate the actual state of the engines as well as the command, with the 
engine state shown as the blue marker. 

Since the FEP system is designed to protect vehicle energy through use of throttle/EPR, additional 
features are added to the EPR scale. The EPR FEP display is similar in operation to the PID. A safe area is 
indicated by a light gray area on the EPR scale, with yellow horizontal bars indicating the upper and lower 
limits of the safe zone. Unsafe areas are shaded dark gray. A horizontal green bar indicates the actual EPR 
command that is being sent to the aircraft as computed by the FEP system. If the pilot sets a safe throttle 
command, the pilot and FEP commands are coincident. 

IV. B. 3. Flap Scale 

The flap scale is located to the right of the EPR scale and indicates current flap setting in degrees. Flap 
settings of 0, 1, 5, 15, 20, 25, and 30 degrees are shown. The commanded flap setting is indicated by a white 
chevron-shaped command marker, and the actual flap deflection is shown as a blue bar extending downward 
from the top of the tape. 

c The authors in [28, 29] use a similar representation to communicate estimates of “safe” control input bounds which, 
if violated, would potentially result in flight envelope limit exceedances. In those works, the bounds are computed via model 
predictive control techniques and are presented as minimum constant control inputs that would lead to envelope violations at 
the end of a pre-specified prediction horizon. In a separate work, the authors of [30] use optimal control techniques to provide 
visual and haptic input-space pilot cues for vehicle upset recovery. 
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IV.B.4- Speedbrake Scale with FEP Display 

The speedbrake scale provides the pilot with an indication of the (symmetric) spoiler deflection used as 
speedbrake, and is controlled via the speedbrake lever. A white chevron shaped command marker indicates 
the commanded speedbrake deflection. A blue bar extending downwards from the top of the tape indicates 
the actual speedbrake deflection. 

The FEP system is designed to protect (maximal) vehicle energy through use of the speedbrake. As with 
the EPR display, a green marker indicates the actual speedbrake command that is being sent to the aircraft 
as computed by the FEP system. 

IV. B. 5. FEP State Annunciator 

An FEP state annunciator has been added above the PID to indicate the current functional mode (or sub- 
mode) of the FEP. When the FEP system is “On” but not actively modifying the pilot command, the system 
is “Armed” and the annunciator shows the label “FEP Armed” in black on a yellow background. If the FEP 
overrides at least one of the control inputs set by the pilot, the annunciator turns green and the label changes 
to “FEP Active” , also in black. The color green has been chosen to be consistent with the green markers on 
the control- input displays that represent the most preferable control input. 

V. Display Operation 

V. A. Normal Operational Mode 

The FEP display has been created to facilitate pilot situation awareness with respect to the automated FEP 
system. Piloted simulations have revealed that pilots may react adversely to this type of command-modifying 
automation if they are not aware that (z) their command is being modified by the automation, and (ii) why 
the automation is modifying their command. For example, in a simulated severe wind shear event using 
only conventional flight instruments, the FEP system commanded a nose-down pitch to prevent an imminent 
stall. The pilot, unaware that the FEP had intervened, felt he had “lost control” of the aircraft, when in 
fact the FEP had potentially prevented an LoC event from occurring. The proposed display is an attempt 
to provide this information to the pilot in an intuitive, veridical, and unintrusive manner. It is not claimed 
that the proposed display format is optimal in any sense; however, the information that the display provides 
is the critical aspect of its design. The display provides necessary information to the pilot about the state 
of the automation that previously has not been readily available. As will be demonstrated shortly, the FEP 
information feedback is provided to the the pilot both in the output space (vehicle performance as indicated 
by the PFD) and in the input space (vehicle control inputs as indicated by the EPD) in a non-redundant 
manner. 

During normal operation with the FEP system “On” and the pilot command within the safe region of 
the input space, the FEP system is referred to as “Armed.” The protection system is actively monitoring 
the aircraft state and will intervene by limiting the pilot commands in the event that the pilot inputs an 
unsafe command, or if the vehicle impinges on an unsafe portion of the flight envelope. The FEP system is 
said to be “Active” when it is actively limiting pilot commands. 

As an illustration, consider the following scenario. Initially, the aircraft is in level flight at roughly 
200 KCAS. The aircraft is given a pitch- up command and held at higher than normal pitch attitude with 
the throttles near idle, as shown in Figure 6a. As the vehicle loses airspeed, the angle of attack increases 
toward the hard upper limit. With the aircraft still being commanded to pitch up, the FEP detects that 
the vehicle is nearing an unsafe portion of the flight envelope and reduces the safe input space area to pitch 
the aircraft nose down and prevent stall, as shown in Figure 6b. Here, the blue dot indicates pilot intent, 
while the actual command sent to the vehicle by the FEP, depicted by the green dot, remains within the 
safe portion of the input space. Together with the appearance change of the FEP annunciator, this indicates 
both that the pilot command is in conflict with the FEP and how the pilot’s command is being modified. 
Additionally, the performance indicators around the PFD on the left of 6b show that airspeed and AoA are 
at the FEP limits, and there is a color change of the AoA limit to red to highlight the limiting variable(s). 

While the scenario presented above is simplistic, it is illustrative of the motivating concept. The EPD, 
along with the modified PFD, is a means to communicate to the pilot the state of the aircraft and the state 
of the automated FEP system. The PFD provides performance indicators which allow determination of 
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the state of the aircraft in both absolute sense and in relation to the safe flight envelope limits. The EPD 
indicates pilot control inputs and the modifications to these inputs as implemented by the protection system, 
and presents an indication of the available control authority with respect to the FEP limits. In some sense, 
the display is also a means by which to map the FEP limits into the aircraft control input space, indicating 
the commands required to maintain safe operation of the aircraft with respect to the flight envelopes of 
Figure 3. The combination of the FEP display and PFD therefore is an attempt to allow the pilot to quickly 
determine the state of the aircraft and the automation, as well as the intent of the automation. In essence, 
to communicate not only what the automation is doing, but also why the automation is taking a particular 
action. 

It is important to note that the FEP information displayed in the PFD and in the EPD is not redundant, 
as information is not duplicated between the two displays. The PFD contains information about the vehicle 
state, in the output space of the system, and informs the pilot of vehicle aircraft response and location in 
relation to protected flight parameters. However, in the case of the FEP system, the automation state is 
not directly observable to a pilot through the augmented PFD; it is not clear whether the FEP system is 
modifying the pilot commands from the vehicle performance indicators and parameter limits alone. For 
example, an aggressive command near the boundaries of the safe flight envelope may be limited by the FEP 
before the vehicle actually approaches the boundary. Alternatively, the aircraft could be right on the edge of 
the safe flight envelope, which would manifest on the PFD as one or more parameters at the hard limit(s), 
but a pilot command that holds this aircraft state constant would not necessarily be modified. Under certain 
conditions, the pilot may be able to discern whether or not the system is actively modifying the commanded 
input, but this relies heavily on the pilot’s mental model of the system and increases pilot workload, hence 
additional information is needed. Moreover, information from the EPD is not duplicated on the PFD. The 
control input limits of the EPD contain no specific information about the state of the aircraft, only the 
restriction on the control inputs imposed by the set of flight envelope limits. 

To illustrate this point, consider the situation presented in Figure 6c. The aircraft is banked at 30°, and 
the pilot commands an aggressive pitch-up and roll maneuver, represented by the blue dot in the upper left 
corner of the EPD. The FEP anticipates that following this command will cause imminent violation of the 
safe envelope limits, and limits the commands to maximum safe value. Notice here that the aircraft is not 
in violation of any of the hard or soft limits shown on the PFD in Figure 6c, and there is no indication on 
the PFD as to why the vehicle performance is different from what the pilot commanded. Only by presenting 
the information from the input space is it clear why the vehicle response is different from the commanded 
response. 

Finally, we note that it is in no way the intent of the authors to suggest that the format of the display 
presented here is the best format for implementation in the cockpit. The location and sizing of the EPD, 
and the limit displays on the PFD are designed to evaluate their efficacy during simulation-based testing. 
The design of the display elements themselves are a first attempt at providing FEP information to the pilot 
in a simple, intuitive, and veridical manner, and it is highly likely that these elements would undergo many 
design and testing iterations prior to any real-world implementation. However, the key point of emphasis 
is not the physical representation of the information, but rather the information itself. Providing the pilot 
with enough information to be able to observe the aircraft and automation state in both the input and 
output space makes the system more observable to the pilot, places less reliance on the pilot’s mental model 
of the automation, and reduces likelihood of adverse human-automation interaction. Determination of the 
“best” information and method of presentation is a difficult open problem; the display presented here is one 
attempt at improving human-automation interaction in the cockpit of an augmented aircraft. 

V.B. An Alternative Mode: FEP Information without Intervention 

The logic which drives the FEP calculation of envelope limits and safe control inputs can also be leveraged 
to assist pilots without actually limiting pilot commands. In this alternative mode, the FEP logic is running 
but the system will not alter the pilot commands in any way; the pilot has complete authority over the 
aircraft at all times. The envelope limits are still displayed on the PFD and operate exactly the same as 
previously described. Additionally, the EPD is shown with the dynamic safe control input box, which also 
operates as previously described. The safe input command as calculated by the FEP, accounting for pilot 
intent and aircraft safety, is displayed as a green dot, but the pilot command, represented by the blue marker, 
is always sent to the aircraft. If the pilot command is outside of safe control input area, a red halo appears 
around the blue marker to indicate that the FEP has determined the command to be unsafe, and also to 
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(a) FEP armed, no envelope violations and pilot input within safe command area. 



(b) FEP actively modifying pilot input to prevent angle of attack limit violation. 



(c) Aggressive pilot input triggering FEP command modification without PFD limit impingement, 
demonstrating non-redundancy of the two displays. 

Figure 6: Extended flight display in normal operational mode with FEP “On.” 
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distinguish between normal and alternative operational modes. Also, the FEP annunciator changes from 
gray to red as a reminder that the FEP will not intervene. If the pilot command is always within the safe 
control input area, then as before, the FEP suggested command and pilot command are identical and the 
aircraft will not exceed the protected parameter envelopes of Figure 3. 

To demonstrate this alternative mode, consider the same scenario as in Figures 6a and 6b. The aircraft is 
held at high pitch attitude with throttles near idle, as shown in Figure 7a. As airspeed drops and the angle 
of attack increases, the pilot command falls outside of the safe control input area. The red halo appears 
around the pilot input and the green dot indicates the closest safe command as calculated by the FEP logic; 
see Figure 7b. 

The alternative mode retains the flight envelope information generated by the FEP, but avoids some 
of the human-automation interaction issues that arise from limiting pilot control authority, albeit at the 
cost of absence of envelope protection and LoC prevention. Another benefit of the alternative mode (as 
opposed to lack of any display augmentation) is that the system is able to provide a suggested command 
to recover the aircraft from an unsafe condition. At extreme attitudes or flight conditions where envelope 
violations are more likely to occur, it is not always clear to the pilot the correct course of action to recover the 
aircraft, especially since these situations may often be accompanied by failures, alarms, or other factors which 
drastically increase pilot workload. The ability to provide a suggested input to recover the aircraft to within 
the safe portion of the flight envelope, especially in a potentially confusing, high-workload environment, may 
be of great benefit and could potentially support pilot training for upset recovery. Early simulation data have 
indicated that by tracking the suggested command (i.e., tracking the green dot on the EPD), the aircraft 
can be recovered to a safe state while accounting for vehicle safety (structural integrity, stall, etc.). 

VI. Piloted Simulation Evaluation 

Testing of the new cockpit interface will be conducted using the pilot-in-the-loop flight simulator at the 
Illinois Simulator Laboratory, a Beckman Institute facility at UIUC. The simulator, shown in Figure 8, is 
based on a Frasca 142 cockpit, with three projectors providing a roughly 180° view of the “world.” The 
simulator uses the NASA TCM aircraft dynamics model running in Matlab/Sinmlink, and graphics are 
driven by an array of computers running X-Plane. In the cockpit, flat panel digital monitors are used for the 
pilot display interface, and an eye-tracking camera system is used to monitor pilot attention. The dynamics 
model, graphics computers, cockpit display, and camera system are interfaced through a local area network. 
Additional details about the simulator facility can be found in [31]. 

To evaluate the efficacy of the extended flight display, a study is proposed consisting of multiple pilot 
subjects of adequate skill level to fly a series of simulation-based flight tests. Eighteen participants will be 
recruited from the Parkland College Institute of Aviation at UIUC. Each participant will receive a familiarity 
training session followed by three one-hour sessions, one of which is a control condition, and the other two 
are experimental conditions. The familiarity training session is intended to allow the participants to become 
familiar with the flight dynamics of the simulated aircraft, as well as the instrument panel and control layout, 
and requires participants to fly a skill pattern performing standard flight maneuvers. During familiarity 
training there will be no external environmental disturbances, visibility will be high, and the pilot will have 
a clear sightline to the outside horizon. For this session, standard glass cockpit-style instrumentation will 
be used (i.e., only the PFD without FEP limit augmentation, flap scale, and speedbrake scale without FEP 
indication will be displayed to the pilot) and the FEP system will be “Off.” 

After familiarity training, each participant will fly the simulation through one control condition and 
two experimental conditions. Condition ordering is counterbalanced among participants to reduce learning 
effects from one condition to another. Each session will include ten wind disturbance scenarios, each lasting 
approximately two minutes. To ensure the difficulty across all conditions and participants is equal, the same 
ten scenarios will be used for each participant. The ordering of these scenarios will be randomized for each 
condition, and repeated for each participant. That is, for each of the control and experimental conditions, 
the order of the ten disturbance scenarios will be randomized, however the ordering is invariant with respect 
to participants for a particular condition. 

The operational mode of the display will vary for each of the control and experimental conditions. For 
the control condition, the display configuration is identical to that used for the familiarity training session; 
a standard PFD without FEP limit augmentation is used and the FEP system is “Off.” The pilot will 
be in complete manual control of the aircraft during the disturbance scenarios. For the first of the two 
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(a) No limit violations, pilot command within safe command area. 




Figure 7: Extended flight display operating in the alternative mode with FEP “Off.” 


experimental conditions, the display will be operating in the alternative mode described in Section V.B. The 
augmented PFD and PID are displayed with the FEP logic providing suggested commands, envelope limit 
information, and safe control input limit information. The second experimental condition will be conducted 
with the display in the normal operational mode described in Section V.A, where the FEP will modify pilot 
inputs as the boundaries of the safe flight envelope and/or safe control input envelope are exceeded. During 
each experimental session, participants will be given instruction as to the effects of the FEP system and the 
information presented in the display for the particular operational mode they will be using. This instruction 
will be followed by a free-flight session to become familiar with the instrument panel configuration and 
automation mode. Immediately after, subjects will complete the series of ten scenarios in quick succession, 
pausing between each scenario to reset the simulation. 

Each of the disturbance scenarios begins with the aircraft trimmed at a set altitude, airspeed, and 
heading, all of which the pilot is instructed to maintain throughout the duration of the scenario. Initially, 
the pilot will have manual control of the aircraft at the trimmed condition. After a variable length of time 
(15-45 seconds), the external disturbance event will begin. The disturbance events are characterized by 
sudden, strong gusts of wind, intended to cause vehicle upset and potential LoC without adequate pilot 
(or automation) compensation. The wind event will last approximate 30-60 seconds, and each scenario is 
designed to be similar in terms of overall difficulty. 
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Figure 8: Pilot-in-the-loop flight simulator at the Illinois Simulator Laboratory. 


Metrics used to determine the efficacy of the experimental display include number of safe flight envelopes 
exceeded, duration of exceedance, and separation from desired heading, altitude, and airspeed. In addition 
to these metrics, the eye-tracking information will be used to determine which area of the interface panel is 
being attended to by participants. The data collected during flight testing will be used to examine the effect 
of the presence of FEP information on pilot situation awareness with respect to the aircraft and automation 
state, and whether this information is beneficial for recovering from (or preventing) vehicle upset conditions. 
It is anticipated that flight testing will reveal directions for improving the configuration of the display, as well 
as directions for future test development to determine the ability of the display to reduce adverse human- 
automation interaction. In addition, the evaluations may suggest methods for improving pilot training for 
recovery from LoC events and upset conditions. 

VII. Conclusion 

In this paper, a novel interface for displaying flight envelope safety limits and FEP system state infor- 
mation has been presented. The new display is a first attempt at overcoming human-automation interaction 
issues arising from the addition of the FEP system to an augmented aircraft model. The display consists of a 
PFD augmented with flight envelope limits and key aerodynamic information, along with the EPD to convey 
FEP automation state information. These two primary display elements work together to provide vehicle 
performance and input information in a non-redundant manner. While it is not suggested that the format 
of the display is ideal for integration in the cockpits of modern aircraft, the display gives the pilot access 
to information about the aircraft and automation in both the input and output space, reducing reliance on 
the pilot’s mental model by making the system more observable to the pilot, and therefore reducing the 
likelihood of adverse human-automation interaction. Piloted simulation evaluation is planned, which will 
evaluate the efficacy of the display and is anticipated to suggest future directions for cockpit interface design 
or flight training. 
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